System and method for performing distributed asynchronous calculations in a networked environment

ABSTRACT

A method and associated system are provided for performing calculations in a distributed networked environment, comprising: updating a source element on a first computer; sending a calculate update signal to a target calculated element for updating on a target element computer that may be the first computer or a second computer connected to the first computer that uses the source element in a calculation; obtaining the updated source element by a process on the target element computer associated with the target calculated element in response to the sending; and performing a calculation to update the target calculated element using the obtained updated source element.

BACKGROUND

Described below is a system and related method for performingdistributed asynchronous calculations in a networked environment.

A spreadsheet is a basic calculation tool in which users can definedifferent constants in particular cells, and define formulas indifferent cells that reference other cells' values, and then update thecalculated formula values when the cells change. In the simplest form,these cells are arranged in an array in a spreadsheet. A formula cantake both constants and other calculated values as inputs so that achange in one constant can produce a number of changes in calculatedformula values in any cell that relies on that constant either directlyor indirectly.

Spreadsheets can be grouped together in larger entities (Microsoft Excelcalls these larger entities Workbooks). Furthermore, such entities canbe accessed by multiple simultaneous entities. However, such flexibilitycan create significant problems—including ensuring that one person'sedits do not overwrite those of another. Furthermore, as the number ofconstant and calculated values becomes large (on the order of thousandsor more), the sources may span across many networked computer systemsthat can span great geographical distances (and hence may be subject tocommunication delays, outages, etc.), the number of links in acalculation chain becomes large, and certain timing and logisticalissues become more and more difficult.

SUMMARY

Disclosed herein is a system and method that efficiently, robustly, andflexibly permits large scale distributed asynchronous calculations in anetworked environment, where the number of users entering data is large,the number of variables and equations are large and can comprise longand/or wide dependency chains, and data integrity is important. Thenetwork would typically be a wide area network (WAN) that may introducesome delay in communications between computers, although the network isnot limited to this specific type of network, and could be a local areanetwork (LAN) or some form of a bus architecture.

An area where the invention is particularly useful is in the preparationand filing of Securities and Exchange Commission (SEC) documents.Certain filings can require the input of hundreds or thousands ofvariables and include the input of hundreds of individuals.Historically, such input would be curtailed days in advance of aparticular filing to ensure that the carry-forward calculations hadconsistent data and adequate time for entry. However, with the systemand method disclosed herein such updates can be made with asignificantly smaller delay in producing a final output with greaterassurances of integrity.

Although this system and method are well suited for the above-mentionedapplication, their application is not limited thereto, and can be easilyadapted and applied in any form of a distributed environment.

A method and associated system are provided for performing calculationsin a distributed networked environment, comprising: updating a sourceelement on a first computer; sending a calculate update signal to atarget calculated element for updating on a target element computer thatmay be either the first computer or a second computer connected to thefirst computer that uses the source element in a calculation; obtainingthe updated source element by a process on the second computer systemassociated with the target calculated element in response to thesending; and performing a calculation to update the target calculatedelement using the obtained updated source element.

DESCRIPTION OF THE DRAWINGS

Various embodiments are illustrated in the following drawings, in which:

FIG. 1 is a block diagram illustrating an exemplary element used in thesystem;

FIG. 2 is a block diagram illustrating three exemplary elements used inthe system;

FIGS. 3A, B are block diagrams illustrating a number of elements, eachon separate computers that are interconnected via a network with oneanother, and an update scheme;

FIGS. 4A, B are pictorial diagrams representing numerous elements andinterconnections/relationships that might be present in a given system;and

FIG. 5 is a block diagram illustrating a certification process.

DETAILED DESCRIPTION

At the core of various embodiments of the invention are the elementsinvolved in calculations and the calculations using those elements aswell.

FIG. 1 is an exemplary block diagram illustration of an exemplaryconstant element E1. As FIG. 1 illustrates there may be at least threeparameters associated with the element E1: a global revision number G, alocal revision number R, and a value V. The global revision number G maybe used to support reconstructing states of a calculation graph (where agraph refers to a set of constants, equations, and the relationshipsbetween them at a point in time) at any state in time. The globalrevision number G tracks the number of revisions (changes in value,structure, and meta data) made to one or more graphs associated in someway, for example, all graphs belonging to a particular set of users, ora “company.” This allows, for example, the entire state of a graph to bereconstructed based on any particular revision of a given element. Thelocal revision number R is local to each element, and tracks therevisions made to that element, it gets incremented any time an elementis modified or persisted. Additional parameters could also be associatedwith the element or each of the respective revisions, such as a creationand/or modified time stamp, the entity responsible for entering thevalue, the source location of the element, the list of other elementsreferenced by this element, the list of elements this elementsreferences.

The element E1 shown is a constant, which may be entered by a user in aform, table, or fielded document, e.g., displayed on a computer screenor originate from some other data source. However, this element couldalso be a variable that is the result of an equation or calculationdesigned to take other inputs that are either constants or the resultsof other equations or calculations. If an element represents anequation, the equation is stored in/with the element as well. This meansthe relationships can be fully defined using only the elementsthemselves.

As can be seen in FIG. 1, the element E1 has three revisions associatedwith it, with each revision having a changed value. As can be seen inFIGS. 1 and 2, the global revision numbers G do not necessarilycorrespond 1:1 with the local revision numbers R, and that for differentconstants (E1, E2), a global number revision number can reflect adifferent local revision number. Each time one of the constants E 1 orE2 changes, a new local version number for E3 may be created, but thisis not always the case. There may be deeper formulas that dictatewhether such updates get new version numbers (and getpropagated)—particularly for formula elements whose values do notchange.

By way of a simple example, if element E1 increases by one while elementE2 decreases by one, then, for a simple addition by element E3, there isno value change to E3, and hence the revision does not have to increment(and no further value change needs to propagate), even though theunderlying values do. Constants and calculated values may herein bereferred to as “elements”, and bear some similarities with cells in aspreadsheet, although the data associated with the elements herein canbe much richer and permit significantly enhanced capabilities.

The local revision numbers are element specific and are incremented anytime a value stored on, or associated with, the element changes. Globalrevision numbers may be incremented when saving a group, or batch, ofchanges together as an atomic group. This allows a complete view of oneor more graphs to be retrieved. Utilizing two distinct revision numbersalso allows for multiple “working copies” of a given element to exist.For example, if “user” or “process” generated changes only incrementlocal revisions numbers, and the global revision number is onlyincremented when applying the users changes to the global, “shared”,version of the elements, then it is possible to know and separate otherusers' changes from system changes. Using two revision numbers is alsouseful for reconstructing a graph at a point in time. It allows multipleversions of the same graph to be calculated at once.

The association of a revision history with a particular element providesmany benefits, including the ability to return to any particular stateof the system at any time, or to generate a report that is a snapshot atany particular point in time. In order to produce a system state basedon a particular revision of an element, only revisions of elements witha global revision number less than or equal to that element's globalrevision at the desired revision are used in the calculation.

The system does not require any historical versions of the elements tobe stored—only the latest version is needed. In many cases it isdesirable to leave all historic versions of the elements for auditpurposes, such as is the case for SEC reporting. However, when storagespace is constrained or system resources limited, there are compressionand cleanup mechanisms which may be implemented to offer historicreporting or audit capabilities. One common cleanup mechanism is tostore only the global revisions and the latest local revision of eachelement. This has the advantage of not losing information or majorstates of the system. Global revisions may also be compacted either ondemand or periodically. In the global compaction process some interimglobal revisions are deemed unneeded and removed, leaving only thedesired global revisions. Depending on the use-case's requirements,global revisions stored on historical versions of elements may requireupdating to ensure historic reports will always appear consistent.

FIG. 2 illustrates a simple three-element configuration in which two ofthe elements E1, E2 are constants, and one element E3 is a calculationthat is based on the two constants (E3=E1+E2). As can be seen, each ofthe versions found in elements E1 and E2 may also be tracked in thecalculated value E3. For example, when a current local third version ofelement E1 (E1_(R3)) is changed from a value of three (E1_(V(R3))=3) toseven, a new local version four (E1_(R4)) is created. But since thisalso will trigger a change in E3, a new local version of E3 must becreated. The local version is updated each time the element changes.

Some mechanism is provided to notify an element that it must berecalculated. In one embodiment, calculated values may include an updateflag UF, which, when set, indicates to the element that the flag belongsto that the element should perform a recalculation. As an alternative tothe update flag (UF), or possibly in addition to it, when elements E1 orE2 are changed, element E3 may be sent a signal (e.g., in the form of amessage) indicating it should recalculate its value. This is describedin more detail below, although, as used in the claims, a “signal” couldbe construed generically as including both a sending of a message,setting an update flag, or any other form of communication within acomputer system or computer network. This signal may be referred toherein as a “calculate” signal or an “update” signal.

FIGS. 3A and 3B are block diagrams illustrating a simplistic networkedgroup of interdependent elements, where constant elements E1, E2, andE4, are used as inputs into formulas on calculation/equation elementsE3, E5, and E6. As noted above, in an actual system, there may bethousands of different elements in a system. The low-level system doesnot inherently restrict the arrangement of elements in the system, itrequires only that relationships are directed. Here, “directed” meansthat any given element knows which other elements to notify when itsvalue changes. Note that graphs are not required to be acyclic(non-circular, meaning an element's value may influence its own value)as long as the implementer desires an infinite loop or an element'svalue converges to some point indicating the calculation process shouldbe stopped. However, in practice, some restrictions are often enforced;requiring acyclic relationships is a very common restriction.

There are several mechanisms to prevent infinite loops. If cyclic graphsare allowed, then a convergence criteria may be defined. In that case,the previous and new value are compared. If they are less than somedefined amount, the value is considered unchanged, and the list ofelements using that element will not be sent the “recalculate” signal.Often, it is also (or alternatively) useful to include a max iterationlimit, so that the value of any given element will only be recalculatedsome maximum number of times. If the limit is hit, recalculate messagesare not propagated any further. If cyclic graphs are not allowed, then alist of elements already visited (referred to as “causers”) may bepassed along with the calculate signals. If an element finds itself inthe causers list, it would then set its value to a special markerindicating a circular relationship and propagate the calc message. Inthis way, the entire segment of the graph with the circular relationshipcan be flagged as being in an error state. The causer list commonlytakes the form of a list of element ids, or a special index (a bitmap),that may be checked. The choice is implementation dependent, dependingonly on the specific requirements.

In FIG. 3A, each of the elements may reside on a separate computer in anetwork, and the computers are interconnected via a network. How theelements access and address one another is not relevant herein, otherthan to say that each element can be uniquely addressed so that itsparameters and values can be reachable in the networked environment.Since the computers can be located at large geographical distances fromeach other, it is possible that delays exist in the transmission of theelements or “signals” from one system to another.

As can be seen in FIG. 3A, an update to element E1 and/or E2 triggers anupdate in calculated elements E3 and also E5 and E6. It is ahierarchical process in which an update to one number can affect manyother numbers in a cascading effect. It is possible, in certaincircumstances like the SEC example described above, for a one numberupdate to affect many thousands of others—forming a massive ripple thatgoes through the system. FIG. 4A is a pictorial diagram of a smallportion of an exemplary real-world graph, illustrating a number ofelements, including Ex, Ey, and Ez, and respective interconnections toother elements. FIG. 4B is a global view of the elements andinterconnections that may exist in a typical graph. There may be manythousands (there are over 5,000 elements in FIG. 4B) of elements with aneven greater number of interconnects/relationships. As can be seen inFIG. 4B, some of the elements (those nearer the outer edge) have fewdirect interconnections with other elements, whereas some of the morecentrally located elements have many direct interconnections.

However, in contrast to precomputing and using the resultant partialordering of the graph to determine the order of updating, and thenperforming every calculation in one pass, as might be performed in atypical spreadsheet, the system and method herein utilize a differentapproach. In the spreadsheet context, everything must be loaded into thecalculating system and operated on all at once or loaded and evaluatedsequentially. Both of those approaches are more resource intensive withlarge graphs. Such an operation in such a large and distributedenvironment could cause the calculating system to hang, as it performsthe many calculations serially or possibly in parallel where the graphpermits.

Furthermore, the introduction of many chained networked documents wouldmake such an approach undesirable, as the delays could exponentiallyincrease. And in a cloud/collaborative environment, many people and manysources can be changing elements at the same time—having two separatesources changing elements that feed into a common formula creates a hugesynchronization problem, in order to ensure the final number that comesout is correct. Two individuals can get two different numbers from aformula if not synchronized properly, i.e., updater A may have gotten anumber based on a number that updater B committed, but updater B did notget updater A's number.

The easiest solution is to lock the graph (i.e., the elements involvedin the calculation), although this exacerbates the delays that may beobserved in the system, since one calculation must complete beforeanother may begin. The system and method herein store the elements asseparate items in a distributed database, and when a change is made(e.g., to element E1) that impacts other calculations (e.g., elementE3), the element E1 sends a message to the impacted element E3 “updateyourself”.

This message could be presented in any form, and one exemplary way wouldbe to set the update flag UF associated with the element that is setwhenever one of that elements inputs changes. The update message mayalso be passed through a message queuing system. When the update messageis read, a reading process may perform the relevant calculation ordispatch another process to perform the calculation. The element E1 mayknow that it impacts element E3 by a stored list of elements identifyingother elements that use element E1 in calculations, or because elementE3 stores a queriable list of elements required to calculate its value.

The list of elements using a particular element or used by a particularelement may include additional metadata, such as version informationabout the related elements. This metadata can be used to optimize thecalculations, reducing possibly unnecessary duplicate calculations, asdescribed in more detail below.

In FIG. 3A, once the element E3 receives an indication that it needs tobe updated (update signal), it may acquire all of its inputs fromsources (obtain updated data) (and element E3 knows that elements E1 andE2 are its sources based on its list of elements required or the valueof its formula) and then performs the calculation. When element E3 hasfinished its calculation, it knows that it needs to send a message orflag (update signal) to elements E5 and E6 to update themselves, since achange in element E3 will impact elements E5 and E6. Elements E5 and E6then respectively obtain the updated data from element E3. Element E6also fetches the latest value of element E4 to ensure it has the latestvalue, and to potentially reduce later calculations if element E4 wasalso recently changed. In addition, when element E3 saves its new state,it updates its local revision number, R. All updates to elements may beperformed transactionally, and in the event of a collision, thecalculation step for that element that hit the contention error isrepeated to ensure consistency. An exemplary table showing the “used”inputs and “using” outputs for each element is provided below.

TABLE 1 Example Element Inputs and Outputs Used Input Using Output(Source Elements (Target Elements Element for Element) for Element E1 E3E2 E3 E3 E1, E2 E5, E6 E4 E6 E5 E3 E6 E3, E4

The use of an update flag UF has an advantage in that it may saveunnecessary calculations. For example, if both elements E1 and E2change, the update flag for element E3 is set only once, and element E3can be fully updated by acquiring currently updated values for elementsE1 and E2 and performing the calculation a single time.

Alternately, or additionally, the update indications, signals, ormessages that are sent to the elements upon change can be batchedtogether, and a smart batch manager for a given system can eliminateunnecessary update requests. For example, in the embodiment shown inFIG. 3B, the message queue might contain an update message for elementE6 from both element E3 and E4. The queue reader or handler coulddetermine that the update calculation only needs to be performed once,even though there are two separate update requests in the queue. Whenthe number of update requests for a given element are large,considerable effort can be saved by performing the calculation a singletime and discarding the remaining queued update requests.

The messaging system also has the advantage that it does not require themessage's target element to be loaded from the persistence layer intomemory, and also reduces the possibility of producing contention on thetarget element from multiple sources trying to update an update flag UF.In this way, greater overall efficiency can be provided to the updatecalculations at the possible expense of some local inefficiency incertain pathological cases (where elements have a huge number of usedand using elements).

Many of these pathological poor performance cases can be easilyoptimized for, however. For example, the case where the dependenciesform a “chain” (a graph with maximum width one, or, where each element'svalue depends on at most one element, and its value impacts at most oneother element), some efficiency can be gained by serially calculatingthe values in one process rather than passing messages between multiplecomputers. Elements that are impacted by many other elements can beoptimized to “batch” their update messages to reduce the number ofunneeded calculations done. Messages targeting elements that are insimilar locations, either physical or logical, may also be batched andaddressed to specific computers or clusters of computers to improveefficiency.

The updating itself can be handled by a background process of thecomputer which has access to the element to be updated or where theelement is located. Advantageously, this can distribute the computationof variables across multiple systems, and, as the networked system as awhole grows, the available computers to perform the calculations may beeasily increased as well. Given this allocation of processing power,however, it is not problematic if a variable calculates itself twice,based on two variable input changes occurring around, or at, the sametime. The batching mechanism helps reduce, but does not fully eliminate,the inefficiency induced by a particular element being calculatedmultiple times. Some of the inefficiencies from over calculation arereduced, however, because values of inputs are not “passed in”, butrather the most up to date values of inputs are fetched immediatelybefore calculating, and propagation of calculate messages is stopped ifthe value does not change. In many cases, the inefficiencies are reducedto near optimal levels. This reduction occurs because in many cases onthe first calculation the new value of both inputs will be fetched, andhence the next calculation will find an unchanged value and exit withoutpropagating the calculate message (note the first change will propagatethe message).

In the way described above, the changes in the system can propagate, andusers can be sure that everything is eventually up-to-date.Advantageously, the system is auto-/self-correcting. An editor may benotified that input or output elements have been updated, and thusanything relying on these elements needs to reload. Note, however, thatit is not required that editors be notified of such changes for thesystem of elements to remain in a correct state. When an editor savestheir changes, their changes will be “mixed” with the most up-to-datevalues, producing a correct graph state. Each element needs to know itsrelationship to the other elements, as described above, and suchrelationships may be kept in an adjacency list or by constructing theelements as a linked list. If each element locally stores its adjacencylist of what is dependent upon it and what it affects—it is able to sendsignals that, after processing, facilitate answering questions such ascompleteness and enhanced error recovery.

The data structure built by outputting and processing status signalsfrom the calculation process can be used to determine the status of agraph by storing: 1) a representation of the graph as an adjacency listsplit into two sub-lists (described in more detail below); 2) metadataabout the number of elements in each element's adjacency list; and 3)the largest known revision of each element. After each re-evaluation, amessage may be output which contains the following information: a) anidentifier of the element that was re-evaluated, b) the current globaland local revision numbers of the element, c) a list of elements thatuse this element in a calculation, and d) a list of elements used in theevaluation and their respective version numbers.

One further advantage is that, because of local caching of elements,once an element has been computed, it can have fast access and cancompute the value a second time much faster. This is also a veryscalable process, and a user can accelerate the calculation speed in ascalable manner, the calculation and updating can be running on howevermany machines are available in the system—so the updates, and recoverycan occur very fast—the performance gains on the calculations remainover prior art systems.

The adjacency list of elements using (the “using output” of Table 1) aparticular element may be split into two components, a “pending” and“completed” list. The pending list stores the target elements using thesource element, but that have not yet indicated they have seen (i.e.,incorporated) the element at its current revision. This indication maybe in a form of a sent message (to the source element or to a managingprocess that updates a database), or in a form of a managing processthat updates a database.

The completed list contains the list of elements which have seen theelement at its most recent revision. The expected length of thecompleted list, or a marker indicating that information about the lengthof the list is yet unknown, is also stored. This makes answeringquestions about the state of the graph very easy, when nothing remainsin a pending list and no “unknown” markers remain, the graph is in acomplete and consistent state.

The status messages used to build the data structure are typicallyoutput to a message queue system. The queue may be a specialized messagequeue system, a database, or some other persistence layer that supportsretrieving messages using a query. By queuing the messages, they may beserially, or approximately serially, processed in bulk to reduce theamount of contention maintaining the adjacency list. Updates toindividual element's states must be applied in a transactional way. Inmany cases, for performance reasons, the entire graph state may berepresented in a single data structure (solutions for this are addressedbelow, in the section on Sharding). Therefore, without bulk processingof the status messages, there might be considerable contention updatingthe adjacency list, limiting the throughput of the status system. Notehowever, that contention on this structure does not negatively impactperformance of the actual calculation operations. In someimplementations, the adjacency list may be maintained on dedicatedsystems capable of holding it entirely in memory or other very highperformance storage media and might use a specialized database or keyvalue store to further optimize these operations. In this way themessages may be read from the queue and applied in parallel, which cansignificantly improve performance.

If a message is received that used an older version of a given element,it may be discarded, as it is out-of-date. If the message used a newerversion of an element than previously seen, the elements in thatelement's “completed” and “pending” list are removed, its using-lengthis set to the unknown length marker, and its revision information isupdated to reflect the latest known revision. This ensures that even ifmessages arrive out-of-order, updates to the adjacency structure will becorrectly applied and the adjacency structure will, eventually, be anaccurate representation of the system state.

The original triggering of the updating can occur based on an updater'spressing a “save” button. However, the updater can see the impact of herchanges without committing them by the system obtaining a local copy ofthe existing values. As can be seen in FIG. 3B, an updater who isconsidering a change to element E1 can obtain local copies of all (orselected) elements that the change will impact (elements E3, E5, andE6). This allows rapid loading, without recalculating the values, of thegraph state to be used in, for example, reporting or for additionalcalculations.

As another optimization, since the impacted elements also require otherinputs, local copies of these elements can be obtained as well, so thatlocal copies of elements E2′-E6′ are present on the same system aselement E1, but this is not required. Once the updater reviews thechanges using local copies of elements E2′-E6′ and approves them, shecan then share her updates with the rest of the world. In addition tothe use of local copies of elements E2′-E6′, a temporary or alternateserver, or “user” specific copies of elements on the shared storage,could be used to provide this staging (or draft) workspace.

The temporary local copies of these “draft” elements may also existdistributed across one or more machines, and in fact, when distributing“draft” elements, only elements with values that differ as the result ofa change need to be stored to rapidly present the user with theirchanges. As an alternative to local copies of the elements, the“difference” between working copies and shared elements maybestored—much like a common “patch” (or “diff”) file. The elementdifference contains only the information required to reconstruct thelocal version of the element from the shared version; this has theeffect of preserving other users changes to metadata but allowing thevalue to be updated based on more recent calculations.

In order to ensure that the final impact of updating an element is knownto the updater, some mechanism needs to be put in place to ensure allupdates throughout the system have been applied. One mechanism is toblock the updater from further operations, and only upon allowingfurther operations to resume can the updater be confident that theupdates have been fully applied throughout the system. Another mechanismcould be to graphically illustrate to the updater the progress beingmade as the results of the change propagate throughout the system.

Another mechanism for this is to utilize the revision values in order toreconstruct the various states of the system. In this way, the “current”state of the system is always up to date, and the changes are appliedusing the calculation process itself, then the historical revisions ofthe overall system are computed and stored for later retrieval, if andwhen needed. Then, if a user requests a copy of the graph, or a part ofit, the revision numbers may be used to provide a fully consistentversion of the graph. To determine when all changes have been fullyapplied, a global graph state adjacency data structure may be used, asdescribed above.

In one embodiment, the end calculated value can actually be presented tothe updater as if it has been changed, when, in fact, it has not yetactually been changed (i.e., the update fully applied). This might beaccomplished by “injecting” known changes so that a user making changesand reloading a document will see the expected version (i.e., consistentwith their expectation) of that document.

In an application like EDGAR used by the SEC, one needs to guarantee afully consistent view—so the system must either block new changes and/orblock generating the EDGAR data while its recalculating. Or,alternately, EDGAR could be provided with a fully consistent historicalview—to prevent it from getting some interim state (and thus, likely,inconsistent state) of the graph. So a user could perform anEDGAR-related operation based on a specific shared revision, or EDGARcould wait for the update to finish, and then the user waits to beginpropagating the changes until EDGAR is finished.

Alternately, users could define certain updates as “drafts” and not usesuch “drafts” to update EDGAR (i.e., take the latest fully consistentshared revision). However, there will still exist points where portionsof the graph are inconsistent while applying the drafts to the sharedstate. A locking mechanism may be implemented to prevent EDGARgeneration while a calculation is in progress and to prevent acalculation from initiating when EDGAR generation is in progress. Thestate of the calculation is easily determined using the graph stateadjacency data structure.

Unlike a traditional database, this system and method do not need theentire database or graph to be present to compute a particular portion.Instead only the elements specifically required for a given calculationare required to be made accessible in the database or via some other RPCmechanism.

Furthermore, the system could also provide partial sharing when anupdater just wants to share a small portion, a section, a table, orsmaller view. The elements associated with the share may come fromanother document, or can link back into the updater's document. In othersystems where the values are computed, then applied to the global state,there may be elements that spider-web out into other documents thatcause the system to share all of, or portions of, other documents at thesame time. With this distributed calculation and application mechanism,one is only required to share these “extra” items when creating a newelement in a different document than the one being shared, then adding anew usage of that element within the document intended to be shared. Theother case when additional documents may be required to be shared iswhen elements are deleted that are used elsewhere, but this is animplementation detail that may be determined by the specific usecase—for example some systems may leave the “orphaned” elements in useand others might implement a process to cleanup such cases.

When multiple updates are made, each update has a version and a batchid. This allows the application of updates and calculations to betracked, and it is possible to answer questions about the state of anyone batch of changes. By saving the temporary versions of the elements,as discussed above, to shared persistent storage, a collaborative draftsystem can be created allowing changes to be safely held in draft for along period of time and then later shared to the global system.

In other common implementations, the partial-order of the graph iscomputed, then the elements are evaluated according to that ordering.This will result in the optimal number of calculations, but the initialexpense may be quite high. A hybrid design might be utilized in whichthe first pass is always an asynchronous walk of the graph, then, if thegraph is: 1) simple enough or 2) or exhibits pathological features, suchas massive “fan outs/fan ins”, the partial order can be used that waspreviously computed (implicitly via the asynchronous walk) to optimizesubsequent evaluations. An example of a pathological graph is one whereone or more elements have many, many contributors and also impact many,many other elements. In those cases, the algorithm often works verywell, but it will result in some over-calculations that can be easilyoptimized using information about the graph as described above. This hasthe benefits of allowing previously unknown element systems to beevaluated quickly in many cases, and subsequent alterations to thatsystem to be evaluated much faster.

As described above in the section detailing the graph state adjacencystructure, it is possible to determine when an element's directsuccessors have been completely evaluated based on its latest knownvalue. It is also known when the latest version of a particular elementhas not yet been seen, since the revision of the elements used in acalculation is also tracked.

This information may be stored on a per-graph basis. A given workbook ordocument might contain many graphs and a given graph may span manydocuments or workbooks, however. Updates must be computed and applied tomany graphs simultaneously. In order to accomplish this withoutrequiring the loading of a large hash-map, the graphs may be organizedinto indexed collections. This allows only the collections containingthe graph to which a particular element belongs to be loaded. This easesmemory constraints in most cases while only slightly complicating theoperations required to perform graph merges. This is discussed in detailin the Sharding section below. Based on the adjacency structurerepresentation of a graph's state and the locking system, it is knownwhen a graph is in a fully computed and consistent state.

Determination and Use of Graph States

The following illustrates exemplary mechanisms for the determination ofgraph states. Such determinations can be utilized to determinecompleteness or to reconstruct calculations in the event of a systemerror in which update messages are lost. The following tables illustratea representation of the graph states in a file. Although shown below astext-based values for ease of illustration, the representation of thesevalues in a file can also be done in any sort of a structured binaryform as well.

In the graph states illustrated below, the columns are as follows:Element, Revision, Expected Count, Pending, and Complete, where:

-   -   Element represents the ID of the element;    -   Revision is the global (and local, if applicable) revision info        of that element;    -   Expected count is the number of elements referencing the        element;    -   Pending List is the list of elements expected to reference this        element, but have not yet seen the element at its current        revision; and    -   Complete List is the list of elements that have seen this        element at its current revision.

The table elements may be updated based on Messaging or application ofother rules by which table element states can be determined

The following use case provides tables illustrating evolving graphs in asystem.

TABLE 2 Graph in Infant State Ele- Revi- Expected Pending Complete mentsion Count List List STATE COMPLETE: 0 2 2 [1, 2] [ ] IN- COMPLETE:UNSEEN:

Table 2 illustrates a graph is in an infant state. Only the rootelement, Element 0, is fully known to us; although we know about theexistence of two other elements, Elements 1 and 2, we have no detailsabout them.

TABLE 3 Graph Starting to Develop Ele- Revi- Expected Pending Completement sion Count List List COMPLETE: 6 3 0 [ ] [ ] INCOMPLETE: 0 2 2 [1][2] 2 2 2 [5, 4] [ ] 3 2 2 [7] [6] UNSEEN: 1 2 −1 [ ] [3, 6] 4 2 −1 [ ][6]

Table 3 illustrates a graph that is starting to develop. The rootelement, Element 0, is known to us, and in a partially completed state.We have also received a message directly from Element 6, which is in acompleted state. We have received messages directly from Element 2 andElement 3. Note that we have not yet received a message from Element 1or Element 4, even though their values were used by Element 6(indicating out of order messages), so we know of those elementsexistence. Element 2 is awaiting confirmation that Element 4 and Element5 have seen its current value, and Element 3 is awaiting anacknowledgment message from Element 7.

TABLE 4 Graph in Nearly Complete State Ele- Revi- Expected PendingComplete ment sion Count List List COMPLETE: 0 2 2 [ ] [2, 1] 2 2 2 [ ][5, 4] 3 2 2 [ ] [6, 7] 5 2 0 [ ] [ ] 6 3 0 [ ] [ ] 7 2 0 [ ] [ ] 9 2 0[ ] [ ] INCOMPLETE: 1 2 4 [8] [3, 4, 6] 4 2 2 [8] [6] UNSEEN: 8 2 −1 [ ][9]

Table 4 illustrates a graph in a nearly complete state. All elements areknown, and only a message from Element 8 is required to complete thegraph state. We can infer some information about Element 8 based on themessage from Element 9, but we do not definitively know if Element 8 hasother dependents until receiving the message directly from it.

TABLE 5 Graph in Complete State Ele- Revi- Expected Pending Completement sion Count List List COMPLETE: 0 2 2 [ ] [1, 2] 1 2 4 [ ] [8, 3, 4,6] 2 2 2 [ ] [5, 4] 3 2 2 [ ] [7, 6] 5 2 0 [ ] [ ] 6 3 0 [ ] [ ] 8 2 1 [] [9] 9 2 0 [ ] [ ] INCOMPLETE: UNSEEN:

Table 5 illustrates a graph in a complete state. All elements are known,and in a completed state.

Using this scheme, it is also possible to detect error conditions in thedata. We can easily detect, and mark, missing elements using a specialvalue for revision. In the following example (see Table 6

Graph with Missing Element), the graph is complete, but Element 6 ismissing. We can mark it as complete by passing through the causer's(i.e., the Element that tried sending a message to Element 6, in thiscase Element 1 and Element 3) information through, and marking Element6's revision as “0”. The special “calculate” messages we send to Element6 on behalf of Element 1 and Element 3 will result in a normal calcstatus message being sent back through to the process that maintains thegraph state adjacency list. Because we sent one message with Element 1and one message with Element 3 listed as the causer (as discussedabove), Element 6 will be safely moved to both of the causer's completedlists.

TABLE 6 Graph with Missing Element Ele- Revi- Expected Pending Completement sion Count List List COMPLETE: 0 2 2 [ ] [1, 2] 1 2 4 [ ] [8, 3, 4,6] 2 2 2 [ ] [5, 4] 3 2 2 [ ] [7, 6] 5 2 0 [ ] [ ] 8 2 1 [ ] [9] 9 2 0 [] [ ] MISSING: 6 0 0 [ ] [ ]

It is also possible to detect error conditions in the data resultingfrom incomplete or damaged lists on the elements. For example (see Table7), Element 6's “usings” list is incomplete because Element 9 referencesit. This can be easily detected because the length of the list, 1, isgreater than the expected value, 0. Detecting the opposite case, wherean element thinks it is used by something it is not used by, issimilarly easy. If an element receives a message from something it isnot used by, this condition may be detected, and may then be corrected.This process for detecting this case is similar to that described above.When the calc message arrives with a causer that is not actually used,it may be automatically handled by correcting the data or reporting onthe problem.

TABLE 7 Graph with Error Ele- Revi- Expected Pending Complete ment sionCount List List COMPLETE: 0 2 2 [ ] [1, 2] 1 2 4 [ ] [8, 3, 4, 6] 2 2 2[ ] [5, 4] 3 2 2 [ ] [7, 6] 5 2 0 [ ] [ ] 8 2 1 [ ] [9] 9 2 0 [ ] [ ]BROKEN: 6 2 0 [ ] [9]Sharding

Clearly the graph state representation can become large in the case oflarge or complex graphs. The process that maintains the graph stateentity may be sharded to accommodate this and allow the graph statemaintenance to scale with the system. There are two common incarnationsof the sharding process.

In the first, a “naïve dispatcher” process (i.e., one that ignoresrelationships between elements) may be added that splits the messagesinto their “identity” (element id, revision info, and usings list) part,and their “used acknowledgement” ([used] element id, [used] elementrevision info, using element id) part, then routes those messages to agraph maintainer processes responsible for the element referenced in themessage. The messages will generally be routed to a shard processorassociated with the graph maintainer process based on a hash of themessage's element id with no consideration given to the relationshipsbetween the elements. Often messages directed to a specific shardprocessor may be bundled and assigned an id, this allows the dispatcherto maintain a list of message bundle ids sent to a shard processor. Eachmessage type is applied in the way described above. The shard processorcan then acknowledge the application of each message bundle to thedispatcher. This allows questions of completeness to be easily andcorrectly answered in a transactionally safe way by asking thedispatcher if there are unapplied message bundles for any shards. Theadvantage of this approach is that it is very easy to implement andeasily scalable to any number of graphs, and graphs of any size bysimply adding additional shards.

In the second form of sharding the work, elements related by a graph arekept within the same shard. This has the advantage that completenessquestions may be answered at the individual graph level. There are twocommon methods of accomplishing this. In the first, a graph id isassigned to each element, then maintained as graphs are merged and split(for example, by altering a formula), and the messages are then routedto specific shards, perhaps based on a hash of the graph id and possiblyby an independent “dispatcher” process. The messages are then applied asdescribed above. This method is easy to implement and works well ifgraph merges and splits are infrequent and graph sizes modest. Thesecond method is more flexible, but more complicated to implement. Inthis method an index or list of elements, or graphs, contained withinany given shard may be maintained allowing messages to be routedappropriately. The index might be implemented using a traditionalmethod, for example a tree or hash-map, or using probabilisticstructures such as bloom filters. Depending on the implementation, agraph id may be assigned to elements, as described above, or the indexesmay simply map individual elements to shards. When graphs are merged orsplit, indexes may be regenerated and/or markers left in the previousshard to “redirect” messages for the no-longer-present elements. Theadvantage of this method is that graphs may be rearranged within shardsto optimize the system, for example, to balance work, to place largegraphs in dedicated shards, to give heavily used graphs higher (orlower) priority, or to “archive” older or less commonly used graphs.

All of these approaches described above may be combined to optimize thesystem, and to allow graphs of massive size to be efficiently handled.For example, extremely large graphs might be assigned a special id thatroutes messages related to that graph to a “dedicated” naïve dispatcherprocess, as described above. While smaller graphs might be assignedacross a set of “regular” graph state maintainers. These mechanisms maybe combined and composed in many ways to create systems tailored to thespecific requirements of the application. Message dispatchers may beimplemented as standalone processes or within the other processes.

In all cases, sharded and not, the graph state maintainer processes maybe dedicated systems or may be run on the same systems as thecalculation process itself. The dispatchers and message processors canconsume messages from the queue and either split and route them, in thecase of a dispatcher, or apply them, in the case of a processor.Generally it is preferable for the graph state message processors to runroughly in serial to avoid contention issues. The same is true of themessage dispatcher, since it will maintain a list of message bundlesdispatched to each shard message processor. When the message processorsprocess a bundle, they send a message to the dispatcher notifying itthat that bundle has been applied. This allows completeness questions toalways be answered. However, it also means there can be a lot of writesto those lists, due to the adding and removing. Depending on theimplementation, it may be possible to run many dispatchers andprocessors in parallel, however. The graph state adjacency lists may bekept within specialized databases or key-value stores that offer special“atomic” pipeline or set operations. When systems offering similarfeatures are available, so that contention is not an issue, many messageprocessors may be run at once.

Certification/Approval Process

A further aspect that may be incorporated into the recalculations is thenotion of an approval process and certification. Under theSarbanes-Oxley Act of 2002, CEOs and CFOs of publicly traded companiesare required to certify the appropriateness of their financialstatements and disclosures. However, it is impossible for such highlevel individuals to fully understand each and every component offinancial data that key reports, such as a company's annual report, arebased upon. These individuals thus rely in part on their subordinatesthat each of their respective inputs are accurate. This reliance goesdown through the corporate financial structure. Also because of this,while subordinates are providing data, they may wish to approve thosenumbers before they are used in later calculations.

In many instances, the CEO and CFO are unwilling to certify a particularreport, statement, or financial result unless subordinates who areresponsible for an underlying component are willing to certify thecomponent as well. In a hierarchical manner, the subordinates may havefurther subordinates responsible for an even further underlyingcomponent. At each level, these certifications may serve as an approvalof the number for use by other formulas as well. As a result, an endcertification may actually be the result of many other certificationsperformed in a hierarchical manner. The approval process can be viewedat a more technical level, according to an embodiment, as certifying atrigger for calculations.

FIG. 5 is a block diagram similar to FIG. 3A, but includingcertification elements. In this figure, element E1 requires a manualcertification by employee A that the data entered for element E1 isaccurate. Such a manual entry could be performed by any known form of amanual or digital signature, and known mechanisms could be utilized toensure that any such signature or certification is authentic. The properentities who must certify a particular element are specified in advance,in a manner similar to how calculations and relationships betweenelements are defined in advance. An element could require nocertification, one certification, or multiple certifications in order tobe fully certified. Likewise, an element's value may require approvalsthat are specified in a way similar to that described above before theirvalue may be used in other formulas or reports. Relevant dates, theoriginal source of the number, and other information associated with thecertification or approval could be included.

The certification of an element could initiate a lock on the elementthat prevents further changes to that element. Alternately, a change inthe value of an element could result in a removal of the certificationof that element, meaning that it must be recertified. It is possible tohave a warning message provided to a user or the system when an attemptis made to change a value that has already been certified.

Once a subordinate has entered all values into a document, workbook, orform, their manager might be required to approve those values for usagein other parts of the system. If updates to the numbers are made, thenbefore the calculate signals are sent to other elements, the updatedvalues might need to be re-approved. Once re-approved calculate signalscould be sent to the elements using that value. Alternatively, an updateto the values may not be allowed to be shared to the global state untilthe approval is made, and once approved the values may then be appliedas described above.

Once the element E1 has been fully certified, a flag, or other form ofmarker could be changed in E1, thereby designating that element as a“fully certified” or “approved” element, and an update signal is sent toother elements that may use it as an input. In FIG. 5, upon being fullycertified, an update signal is sent to element E3. It is possible thatthe update signal is a general one that is the same as is sent if avalue is changed. In the alternative, the update signal might simply bea special one that simply indicates the value is now fully certified. Ifthe underlying value itself is unchanged, then there may not necessarilybe a need to completely perform all underlying recalculations. In otherwords, the certification could be operated independently of thecalculations themselves. In this regard, a certification signal (with arelevant element identifier) itself might be sufficient withoutrequiring a further obtaining of the updated underlying certificationinformation.

Element E3 then obtains the updated certification regarding element E1.In one example, element E3 only needs certification from element E1 inorder to be certified itself. If it has all needed certifications (herecertification of element E1), it subsequently sends an update signal toelement E5, which triggers element E5 to obtain the updatedcertification information from element E3.

Any element could require certification or approval from any number ofunderlying/related elements before being certified itself, and couldalso require an independent certification or approval itself. Forexample, element E3 may only require certification of element E1 inorder for it to be certified. In this case, the certification of elementE3 could take place automatically, once it obtains the certificationinformation from element E1. In another example, element E3 requirescertification from both elements E1 and E2, and only upon certificationof both is element E3 certified. Any mathematical rules or criteriacould be applied in the certification (mathematical ANDs, ORs, or otherlogical operators, values less than, greater than, equal to, negative,user defined formulas, such as ratios, etc.).

In a further example, element E3 not only needs the certifications ofunderlying elements E1 and E2, but further requires a manualcertification of E3 itself. In this case, not only would the underlyingelements of E1 and E2 need to be certified, but a signature of a personwould be required before element E3 could be considered fully certified.In order to facilitate the certification process, reports could begenerated that list outstanding certifications needed for any particularelement (and collectively, for multiple elements). Furthermore, for areport, etc. for which all necessary certification have been obtained, areport could be generated showing the full certification hierarchy.

In this way, certifications for complex reports can be easily trackedand managed, thereby eliminating traditional inefficiencies with thecertification process.

The system or systems described herein may be implemented on any form ofcomputer or computers and the components may be implemented as dedicatedapplications or in client-server architectures, including a web-basedarchitecture, and can include functional programs, codes, and codesegments. Any of the computers may comprise a processor, a memory forstoring program data and executing it, a permanent storage such as adisk drive, a communications port for handling communications withexternal devices, and user interface devices, including a display,keyboard, mouse, etc. Software modules may be used to implement variouscomponents described above. When software modules are involved, thesesoftware modules may be stored as program instructions or computerreadable codes executable on the processor on a non-volatilecomputer-readable media such as read-only memory (ROM), random-accessmemory (RAM), CD-ROMs, magnetic tapes, floppy disks, and optical datastorage devices. The computer readable recording medium can also bedistributed over network coupled computer systems so that the computerreadable code is stored and executed in a distributed fashion. Thismedia is readable by the computer, stored in the memory, and executed bythe processor.

All references, including publications, patent applications, andpatents, cited herein are hereby incorporated by reference to the sameextent as if each reference were individually and specifically indicatedas incorporated by reference and were set forth in its entirety herein.

For the purposes of promoting an understanding of the principles of theinvention, reference has been made to the preferred embodimentsillustrated in the drawings, and specific language has been used todescribe these embodiments. However, no limitation of the scope of theinvention is intended by this specific language, and the inventionshould be construed to encompass all embodiments that would normallyoccur to one of ordinary skill in the art.

Embodiments of the invention may be described in terms of functionalblock components and various processing steps. Such functional blocksmay be realized by any number of hardware and/or software componentsthat perform the specified functions. For example, the embodiments mayemploy various integrated circuit components, e.g., memory elements,processing elements, logic elements, look-up tables, and the like, whichmay carry out a variety of functions under the control of one or moremicroprocessors or other control devices. Similarly, where the elementsare implemented using software programming or software elements,embodiments of the invention may be implemented with any programming orscripting language such as C, C++, Java, assembler, or the like, withthe various algorithms being implemented with any combination of datastructures, objects, processes, routines or other programming elements.Functional aspects may be implemented in algorithms that execute on oneor more processors. Furthermore, embodiments of the present inventioncould employ any number of conventional techniques for electronicsconfiguration, signal processing and/or control, data processing and thelike. The words “mechanism” and “element” are used broadly and are notlimited to mechanical or physical embodiments, but can include softwareroutines in conjunction with processors, etc.

The particular implementations shown and described herein areillustrative examples of the invention and are not intended to otherwiselimit the scope of the invention in any way. For the sake of brevity,conventional electronics, control systems, software development andother functional aspects of the systems (and components of theindividual operating components of the systems) may not be described indetail. Furthermore, the connecting lines, or connectors shown in thevarious figures presented are intended to represent exemplary functionalrelationships and/or physical or logical couplings between the variouselements. It should be noted that many alternative or additionalfunctional relationships, physical connections or logical connectionsmay be present in a practical device. Moreover, no item or component isessential to the practice of the invention unless the element isspecifically described as “essential” or “critical”.

The use of “including,” “comprising,” or “having” and variations thereofherein is meant to encompass the items listed thereafter and equivalentsthereof as well as additional items. Unless specified or limitedotherwise, the terms “mounted,” “connected,” “supported,” and “coupled”and variations thereof are used broadly and encompass both direct andindirect mountings, connections, supports, and couplings. Further,“connected” and “coupled” are not restricted to physical or mechanicalconnections or couplings. The term “number” can refer, whereappropriate, to any form of a unique identifier.

The use of the terms “a” and “an” and “the” and similar referents in thecontext of describing the invention (especially in the context of thefollowing claims) should be construed to cover both the singular and theplural. Furthermore, recitation of ranges of values herein are merelyintended to serve as a shorthand method of referring individually toeach separate value falling within the range, unless otherwise indicatedherein, and each separate value is incorporated into the specificationas if it were individually recited herein. Finally, the steps of allmethods described herein are performable in any suitable order unlessotherwise indicated herein or otherwise clearly contradicted by context.The use of any and all examples, or exemplary language (e.g., “such as”)provided herein, is intended merely to better illuminate the inventionand does not pose a limitation on the scope of the invention unlessotherwise claimed.

What is claimed is:
 1. A method for performing calculations in adistributed networked environment, comprising: updating a source elementon a first computer; sending a calculate update signal which is amessage communicated through a message queuing system in response to theupdating, specifically directed to a target calculated element forupdating on a target element computer that may be the first computer ora second computer connected to the first computer that uses the sourceelement in a calculation; obtaining the updated source element by aprocess on the target element computer associated with the targetcalculated element in response to the sending; and performing acalculation to update the target calculated element using the obtainedupdated source element wherein: at least one of the elements comprises alocally stored adjacency list comprising: a used input list comprising alist of source elements that is separate from a particular element thatdefines each and every source element that is used by the particularelement in its calculations; and a using output list of other targetelements separate from the particular element that use the particularelement in a calculation; the method further comprising: sending amessage directly to each of all elements in the using output list of theadjacency list.
 2. The method according to claim 1, further comprising:dispatching, by a dispatcher, a first and second update message directedto a first target element; bundling the first and second update messageinto a bundled message; assigning a bundled message identifier to thebundled message; sending the bundled message to a shard processor thathandles the bundled message; applying each message in the bundledmessage to the first target element; and acknowledging, by the shardprocessor to the dispatcher, application of each bundled message.
 3. Themethod according to claim 2, further comprising: determining, by thedispatcher, a state of completeness if all bundled messages have beenacknowledged.
 4. The method according to claim 2, further comprising:dispatching, by the dispatcher, a third and fourth update messagedirected to a second target element; bundling the third and fourthupdate message into a second bundled message; assigning a second bundledmessage identifier to the second bundled message; and sending the secondbundled message to the shard processor that handled the bundled message.5. The method according to claim 4, further comprising: assigning acommon graph identifier to each of the first target element and thesecond target element that are related to each other; and splitting agraph containing the first target element and the second target elementafter the assigning; and maintaining the common graph identifier in eachof the first target element and the second target element after thesplit.
 6. The method according to claim 1, further comprisingeliminating redundant messages for the updating from the message queuingsystem.
 7. The method according to claim 1, wherein: the using outputlist for one of the source elements comprises: a pending list of targetelements that have not indicated having seen a current version of thesource element; and a completed list of target elements that haveindicated having seen a current version of the source element; themethod further comprising: moving one of the target elements from thepending list to the completed list when that target element indicates ithas seen the current version of the source element; and storing theother elements that have seen the element at its current version.
 8. Themethod of claim 1, further comprising: defining a graph as a pluralityof elements; creating a graph table comprising a plurality of records,wherein each record corresponds to a table element that is one of theplurality of elements, each record comprising: an element number; arevision number; an expected count number; a pending element identifierlist that is a list of elements expected to reference this element butthat have not yet seen the element at its current revision; and acomplete element identifier list that is a list of elements which haveseen this element at its current version; updating a record in responseto an element calculate signal; wherein: each table element isdesignated as being in a state of complete, incomplete, or unseen; anelement in the complete state is one in which the element is seen andthe pending list is empty; an element in the incomplete state is one inwhich the pending list is not empty; and an element in the unseen stateis one for which no signal has been received, but that is used by anelement that has been seen.
 9. The method of claim 8, furthercomprising: determining that the graph is complete when all tableelements are in a state of complete.
 10. The method of claim 8, furthercomprising: reconstructing calculations based on a stored graph table inresponse to a determination of a system error in which update signalsare lost.
 11. The method according to claim 1, wherein each elementcomprises: a value; a local revision number that is updated at leasteach time the value changes; and a global revision number that isupdatable independent of the local revision number, and is usable toidentify a state of the element with specific states of other elements.12. The method according to claim 11, further comprising: storing anolder archive copy of an element when at least one of the global andlocal revision numbers change.
 13. The method according to claim 12,further comprising: loading one or more archived source elements;performing a reconstruction calculation to update a target element usingthe one or more loaded elements.
 14. The method according to claim 13,wherein the loading of the one or more archived source elements is aloading of elements having a common global revision number.
 15. Themethod according to claim 1, further comprising, prior to the sending:obtaining a local draft copy of the targeted calculated element; andperforming a calculation to update the local draft copy of the targetedcalculated element.
 16. The method according to claim 1, furthercomprising: blocking the performing of the calculation until a furthercriterion is met.
 17. The method according to claim 1, furthercomprising: providing a second source element; providing a certificationindicator associated with each of a first source element, which is thesource element, the second source element, and the target element,wherein the target element uses both the first and second sourceelements; modifying a state of at least one of the certificationindicators as certified based upon a predefined criteria; and modifyingthe target element certification indicator as certified only after thefirst and second source element certification indicators are certified.18. The method according to claim 17, wherein the certificationindicator is a flag that is set when the element is certified.
 19. Themethod according to claim 17, wherein the certification indicator is amessage to the target element.
 20. The method according to claim 17,wherein the predefined criteria is an authenticated manual or electronicsignature.
 21. The method according to claim 17, wherein the targetelement further requires either a manual or electronic signature tomodify the target element certification indicator as certified.
 22. Themethod according to claim 17, wherein certifying of the target elementtakes place independently of the performing the calculation to update.23. A system comprising: a first computer comprising a source element; atarget element computer comprising a target element, the target elementcomputer either being the first computer or a second computer connectedto the first computer via a network; an updater that updates a sourceelement on a first computer system; a dispatcher that sends a calculateupdate signal which is a message communicated through a message queuingsystem specifically directed to the target calculated element forupdating in response to the update; an obtaining routine that obtainsthe updated source element by a process on the target element computerassociated with the target calculated element in response to the sendingof the calculate update signal; and a calculation engine that updatesthe target calculated element using the obtained updated source element;wherein: at least one of the elements comprises a locally storedadjacency list comprising: a used input list comprising a list of sourceelements that is separate from a particular element that defines eachand every source element that is used by the particular element in itscalculations; and a using output list of other target elements separatefrom the particular element that use the particular element in acalculation; the method further comprising: sending a message directlyto each of all elements in the using output list of the adjacency list.24. A non-transitory computer program product, comprising a computerusable medium having a computer readable program code embodied therein,said computer readable program code adapted to be executed to implementthe method according to claim 1.